PT-2024-30107 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: xxl-job version 2.4.1 Description: The issue allows a remote attacker to execute arbitrary code via the Sub-Task ID component due to insecure permissions. Recommendations: For xxl-job version 2.4.1, consider disabling the Sub-Task ID componen...

PT-2024-38125 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: A problematic issue was found in SeaCMS, affecting an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross-site scripting. It is possible...

PT-2024-37102 · WordPress · Timeline Event History Plugin

Name of the Vulnerable Software and Affected Versions: Timeline Event History plugin for WordPress versions up to, and including, 3.1 Description: The issue allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input...

PT-2024-28340 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: The issue concerns an Arbitrary File Read vulnerability. It is exploited via the admin safe.php file. Recommendations: For SeaCMS version 12.9, consider restricting access to the admin safe.php file until a...

PT-2024-37699 · Unknown · Heyewei Springbootcms

Name of the Vulnerable Software and Affected Versions: heyewei SpringBootCMS up to 2024-05-28 Description: A vulnerability has been found in the Guestbook Handler component of heyewei SpringBootCMS, affecting an unknown function of the file /guestbook. The manipulation of the Content argument lea...

PT-2024-4813 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue is related to weaknesses in the error reporting mechanism of the software platform. It may allow a remote attacker to obtain sensitive information when a detailed technical...

PT-2024-29418 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.10 Description: A Regular Expression Denial of Service ReDoS issue exists, allowing an attacker to significantly impact the application's response time and potentially render it non-functional by manipulating...

Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS)

Title: Rocket LMS 1.9 - Persistent Cross Site Scripting XSS Date: 04/16/2024 Exploit Author: Sergio Medeiros Vendor Homepage: https://codecanyon.net/item/rocket-lms-learning-management-academy-script/33120735 Software Link: https://lms.rocket-soft.org Version: 1.9 Tested on Firefox and Chrome...

PT-2024-26237 · Opentext · Opentext Imanager

Name of the Vulnerable Software and Affected Versions: OpenText iManager version 3.2.6.0200 Description: The issue is related to a File Upload vulnerability in an unauthenticated session, which could allow an attacker to upload a file without authentication. Recommendations: For OpenText iManager...

PT-2024-20985 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the sys file storage id parameter at the "/WorkPlan/WorkPlanAttachDownLoad.aspx" API endpoint...

PT-2024-25127 · J2Eefast · J2Eefast

Name of the Vulnerable Software and Affected Versions: J2EEFAST version 2.7.0 Description: A SQL injection issue was discovered via the sql filter parameter in the findpage function. This allows for potential exploitation. No information is provided about the estimated number of potentially...

PT-2024-22767 · Alcatel Lucent · Alcatel-Lucent Ale Noe Deskphones +1

Name of the Vulnerable Software and Affected Versions: Alcatel-Lucent ALE NOE deskphones versions 86x8 NOE-R300.1.40.12.4180 and earlier Alcatel-Lucent ALE SIP deskphones versions 86x8 SIP-R200.1.01.10.728 and earlier Description: An issue was discovered due to improper privilege management,...

PT-2024-25190 · Unknown · Library System

Name of the Vulnerable Software and Affected Versions: Library System version V1.0 Description: An issue in the Library System allows a remote attacker to execute arbitrary code via the FAILE variable in the student edit photo.php component. Recommendations: For Library System version V1.0,...

PT-2024-25115 · Thinksaas · Thinksaas

Name of the Vulnerable Software and Affected Versions: ThinkSAAS version 3.7.0 Description: A stored cross-site scripting XSS vulnerability in the component /pubs/counter.php allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter. This...

PT-2024-25747 · Totolink · Totolink Cp450

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP450 version 4.1.0cu.747 B20191224 Description: A stack buffer overflow issue was found in the SetPortForwardRules function. Recommendations: For TOTOLINK CP450 version 4.1.0cu.747 B20191224, consider disabling the SetPortForwardRul...

PT-2024-24156 · Unknown · Rg-Rsr10-01G-T(Wa)-S

Name of the Vulnerable Software and Affected Versions: RG-RSR10-01G-TW-S and RG-RSR10-01G-TWA-S routers version RSR10-01G-T-S RSR 3.01B9P2, Release07150910 Description: An issue in the routers allows attackers to execute arbitrary code via the common quick config.lua file. Recommendations: For...

PT-2024-24510 · Totolink · Totolink N300Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N300RT version V2.1.8-B20201030.1539 Description: The issue is related to a Store Cross-site scripting XSS vulnerability. This vulnerability is located in the Port Forwarding section under the Firewall Page. Recommendations: For...

PT-2024-24489 · Tenda · Tenda W30E

Name of the Vulnerable Software and Affected Versions: Tenda W30E version 1.0 V1.0.1.25633 Description: The issue is a command injection vulnerability in the formexeCommand function via the cmdinput parameter. This allows for potential exploitation. Recommendations: For Tenda W30E version 1.0...

PT-2024-4892 · Oracle · Oracle Complex Maintenance

Name of the Vulnerable Software and Affected Versions: Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13 Description: The issue exists due to insufficient input validation in the LOV component of the Oracle Complex Maintenance, Repair, and Overhaul product within...

PT-2024-24186 · Sourcecodester · Sourcecodester Loan Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Loan Management System version 1.0 Description: The issue concerns SQL Injection via the password parameter in the "login.php" file. This allows for potential unauthorized access to sensitive data. There is no information...